Skip to content

Duplicating DigiCert certificates

A duplicate certificate is an additional copy of an existing DigiCert SSL/TLS certificate, issued under the same DigiCert order at no additional cost. Duplicates let you deploy the same certificate identity to more than one server, such as the members of a load-balanced pool, a disaster recovery standby, or the peers in an application cluster, while giving each server its own private key.

With Certificate Manager - SaaS, you can request a duplicate directly from the certificate inventory, without going to DigiCert CertCentral. The duplicate appears in your inventory as its own certificate, linked to the original, so you can track and manage it like any other certificate.

Note

Duplicate certificates are a DigiCert feature that no other certificate authority (CA) offers, so certificate duplication is available only for DigiCert certificates. The Duplicate action does not appear on certificates from other CAs.

Duplicate, reissue, or renew?

Duplication, reissuance, and renewal all produce a new certificate, but they affect the original certificate differently:

Duplicate Reissue Renew
DigiCert order Same order Same order New order
Original certificate Stays valid and in use Revoked by DigiCert within 72 hours if the reissue changes or removes SANs Stays valid until it expires
Expiration date Same as the original or earlier Same as the original New validity period
Cost Free Free Renewal cost
Typical use Deploy the certificate to additional servers Replace a certificate, for example after losing its private key Extend a certificate's validity

Don't reissue to get a certificate for another server

When a reissue changes or removes SANs, DigiCert revokes the original certificate, every duplicate issued from it, and any earlier reissues within 72 hours. If those certificates are still installed on production servers, the servers start presenting revoked certificates. To add a server without affecting the ones already running, duplicate the certificate instead.

Before you begin

  • Add a DigiCert CA. Make sure you have added a DigiCert certificate authority.
  • Enable duplicates in CertCentral. A DigiCert CertCentral administrator must enable the duplicate certificate feature for your CertCentral account. This is an account-level setting, not a per-user permission. Certificate Manager - SaaS doesn't show whether the feature is enabled. If it's disabled, DigiCert rejects the request, and the certificate request fails with an error such as Duplicate request for certificate with fingerprint ... using CA Account ... failed with CA error: ....
  • Check CertCentral approval settings. By default, CertCentral requires an administrator to approve each certificate request before DigiCert processes it, and duplicate requests are no exception. While a duplicate waits for approval in CertCentral, Certificate Manager - SaaS keeps the request in progress for up to 7 days, and then fails it if no one has approved it. Requests are approved automatically only if the DigiCert user who owns the CA account's API key is an administrator or manager and your account skips the approval step for those roles. For details, see DigiCert's documentation on skipping the approval step.
  • Don't duplicate DV certificates. DigiCert doesn't support duplicates of domain-validated (DV) certificates. The Duplicate action appears on them, but DigiCert rejects the request. To get another copy of a DV certificate, reissue it instead.
  • Keep validation current. DigiCert issues duplicates immediately, with no validation step, so the domain and organization validation for the original order must be current. If it has expired, revalidate in DigiCert CertCentral before you request a duplicate.
  • For EV certificates, use a verified contact. DigiCert requires the requester of an EV duplicate to be a verified contact for the organization. For requests from Certificate Manager - SaaS, the requester is the DigiCert user who owns the CA account's API key, so that user must be an administrator or manager and a verified contact for the organization on the certificate.
  • Use the same DigiCert account as the original certificate. Certificate Manager - SaaS uses the original certificate's fingerprint to find its DigiCert order, so the request must go through a DigiCert CA connected to the account that ordered it. This works whether the original was issued through Certificate Manager - SaaS or was discovered, imported, or uploaded. If DigiCert can't find an order for the certificate, for example because another CA issued it or it belongs to a different DigiCert account, the request fails with an error such as Cannot duplicate certificate ... as cannot obtain info about its Digicert order id.

What a duplicate can and cannot change

A duplicate is based on the original certificate, so most of its details are fixed. The Duplicate Certificate wizard shows the fields you can change and locks the rest.

Certificate detail Duplicate behavior
Common name (CN) Changeable, but must match the original certificate's CN or one of its DNS SANs.
DNS subject alternative names (SANs) Changeable, but must be the same as the original certificate's DNS SANs or a subset of them. You can remove or rearrange SANs, but you can't add new ones unless the original is a wildcard certificate. See the note below.
Key algorithm Changeable. Choose any key algorithm allowed by the request policy. The duplicate always gets its own key pair.
Validity period Changeable. A duplicate can expire before the original certificate, but never after it.
Organization (O), organizational unit (OU), city (L), state (ST), and country (C) Not changeable. The duplicate inherits these values from the original certificate.

Adding SANs to a wildcard duplicate

If the original certificate is a wildcard certificate, you can add SANs to the duplicate as long as each new SAN is a subdomain covered by the wildcard. For example, a duplicate of a *.example.com certificate can include www.example.com, but not www.example.net.

To duplicate a certificate

  1. Sign in to Certificate Manager - SaaS.
  2. Click Inventory > Certificates.
  3. Find the DigiCert certificate you want to duplicate, and then click its name to open the details panel.

  4. Click Duplicate.

    Don't see the Duplicate button?

    The Duplicate button appears only on current DigiCert certificates. It doesn't appear on certificates from other CAs, on expired or (old) certificates, or on certificates that are themselves duplicates.

  5. On the Choose an Application and Request Policy step, the Original Certificate Name field shows the certificate you're duplicating. Do the following:

    1. From the Application list, select the application to assign the duplicate to.
    2. From the Request policy list, select a request policy that uses a DigiCert CA connected to the same DigiCert account as the original certificate. Otherwise, DigiCert can't find the original certificate's order, and the request fails.
    3. (Optional) Select or create Certificate tags.
    4. Click Continue.

  6. On the Certificate Request step, do the following:

    1. Select a Request method.
    2. Enter a Validity period.
    3. Select a Key Algorithm.
    4. (Optional) Change the Common Name (CN) and Domain Name System SANs, following the rules in What a duplicate can and cannot change.

  7. Click Submit Request.

If an issuance approval rule applies to the request, the duplicate must be approved before Certificate Manager - SaaS sends the request to DigiCert, the same as any other certificate request. When DigiCert issues the duplicate, it appears in the certificate inventory as a separate certificate.

Note

You can't resubmit a failed duplicate request. Because duplicates are free, request a new duplicate instead.

Viewing duplicates and their original certificates

Certificate Manager - SaaS links each duplicate to the certificate it was duplicated from, which is called the original certificate. You can follow that link in either direction:

  • In the certificate inventory, duplicates are labeled (Duplicate) next to the certificate name.
  • On the original certificate, the Duplicate Certificates tab lists every duplicate issued from it, with each duplicate's fingerprint, name, creation date, and expiration date. Click a fingerprint to open that duplicate.
  • On a duplicate, the Properties tab includes an Original Certificate Fingerprint field. Click it to open the original certificate.
  • To list duplicates in the inventory, add the Original Certificate Fingerprint column, which is hidden by default, by clicking Columns. To show only the duplicates of a particular certificate, click Filters, select Original Certificate Fingerprint as the column, and enter the original certificate's fingerprint as the value. Learn more about filtering the inventory

Managing duplicates

A duplicate is a certificate in its own right, with its own private key. You can retire, revoke, validate, and download it the same way as any other certificate. Revoking or retiring a duplicate doesn't affect the original certificate or its other duplicates.

However, duplicates have the following limitations:

  • Duplicates can't be renewed. A duplicate can't outlast its original certificate, so the Renew action isn't available on duplicates, and auto-renewal skips them. To replace an expiring duplicate, request a new duplicate from the same original certificate. If you renew or reissue the original certificate, Certificate Manager - SaaS doesn't duplicate the new certificate for you, so request any duplicates you need from it.
  • You can't duplicate a duplicate. Always duplicate from the original certificate.
  • Duplicates are requested one at a time. Bulk duplicate requests aren't supported.

What happens when you reissue the original certificate

In DigiCert, each order has one primary certificate, and duplicates are always issued from the primary. When you reissue the original certificate, the reissued certificate becomes the order's new primary:

  • The previous original certificate is marked (old) in the inventory, and its Previous Versions tab links to the reissued certificate.
  • Duplicates issued before the reissue stay linked to the previous original certificate. They remain valid unless the reissue changed or removed SANs, in which case DigiCert revokes them within 72 hours.
  • New duplicates are issued from the reissued certificate and are linked to it.

As a result, Certificate Manager - SaaS groups duplicates by the certificate they were duplicated from, while DigiCert CertCentral lists all of them under the same order.

Duplicates imported or discovered from DigiCert

When you import certificates from DigiCert, Certificate Manager - SaaS recognizes duplicates, including duplicates that were requested in CertCentral rather than in Certificate Manager - SaaS. Imported duplicates appear with the same links to their original certificates as duplicates requested in Certificate Manager - SaaS.

A duplicate and its original certificate are both valid, and Certificate Manager - SaaS doesn't reconcile duplicates against their original certificate, so an imported duplicate isn't marked (old). Only certificates that were actually replaced, such as by a reissue or renewal, are marked (old).

If machine discovery finds a duplicate certificate before it's imported, Certificate Manager - SaaS marks it as a duplicate the next time you import from DigiCert.

Logging and auditing

Certificate Manager - SaaS logs each duplicate request as a Certificate Duplication Requested event, separate from reissuance, renewal, and new certificate requests, so your audit trail shows when a certificate was duplicated. If DigiCert rejects a duplicate request, Certificate Manager - SaaS logs a Certificate Duplication Failed event. For details on viewing the event log, see event logging.